Is Server/Host or Client authoritative on hit detection? If you're doing detection on a remote, have you taken into account the remote's simulation will be different than the source. Even if motion is replicated perfectly, the timing will be different.

How are you sending updates? As a reliable message or in some snapshot type system? Snapshots only deliver the current state, and will be lossy for individual events if you're trying to replicate fire events.

Otherwise, start adding logs. MP is challenging because their are moving parts on at least two separate simulations; you'll have to get comfortable with isolating these types of issues on your own.